Hello, How do I compare 2 source types within the same index and find the Gap. For Example: index=compare sourcetype=accountA and sourcetype=accountB; we have some account info in accountA but not in accountB and objective is to find that gap.   sourcetypeA accid   nameA  addressA cellA 002         test1   tadd1    1234 003         test2    tadd2    1256 003      test2         tadd2    5674 004         test3     tadd3   2345 005         test4      tadd4  4567 006        test5      tadd5   7800 006    test5           tadd5   9900   sourcetypeB accid   nameB  addressB cellB 002       test1        tadd1    1234 003      test2         tadd2    5674 004     test3          tadd3   2345 005     test4           tadd3  4567 006    test5           tadd5   9900   Output will be: 003         test2    tadd2    1256 006        test5      tadd5   7800   Any Recommendation will be highly appreciated.   ... View more

Hello, I have some issues with parsing events and a few sample events are given below: {"eventVer":"2.56", "userId":"A021", "accountId":"Adm01", "accessKey":"21asaa", "time":"2023-12-03T09:10:15", "statusCode":"active"} {"eventVer":"2.56", "userId":"A021", "accountId":"Adm01", "accessKey":"21asaa", "time":"2023-12-03T09:09:11", "statusCode":"active"} {"eventVer":"2.56", "userId":"A021", "accountId":"Adm02", "accessKey":"26dsaa", "time":"2023-12-03T09:09:08", "statusCode":"active"} {\"eventVer\":\"2.56", "userId":"B001", "accountId":"Test04", "accessKey":"21fsda", "time":"2023-12-03T09:09:04", "statusCode":"active"} {\"eventVer\":\"2.56", "userId":"B009", "accountId":"Adm01", "accessKey":"21assaa", "time":"2023-12-03T09:09:01", "statusCode":"active"} {"eventVer":"2.56", "userId":"B023", "accountId":"Adm01", "accessKey":"30tsaa", "time":"2023-12-03T09:08:55", "statusCode":"active"} {"eventVer":"2.56", "userId":"A025", "accountId":"Adm01", "accessKey":"21asaa", "time":"2023-12-03T09:08:51", "statusCode":"active"} {"eventVer":"2.56", "userId":"C015", "accountId":"Dev01", "accessKey":"41scab", "time":"2023-12-03T09:08:48", "statusCode":"active"} The event breaking point is marked as Bold and I used  LINE_BREAKER=([\r\n]*)\{"eventVer":" in my prop.conf file, but not parsing all events as expected. Any recommendations will be highly appreciated. Thank you. ... View more

Hello, I have a lookup table called account_audit.csv and have a timestamp field UPDATE_DATE=01/05/24 04:49:26. How can I find all events within that lookup with UPDATE_DATE  >= 01/25/24. Any recommendations will be highly appreciated. Thank you!    ... View more

Hello, I have a windows machine with UF installed on that machine. How can I configure my Universal forwarder to ingest windows performance monitoring logs into SPLUNK. Our Windows Source server is located in different location SPLUNK should be getting performance data from. Any help would be greatly appreciated. Thank you!   ... View more

Hello, Line breaker in my props configuration for the json formatted file is not working, it's not breaking the json events. My props and sample json events are giving below. Any recommendation will be highly appreciated, thank you! props [myprops] CHARSET=UTF-8 KV_MODE-json LINE_BREAKER=([\r\n]+)\"auditId\"\: SHOULD_LINEMERGE=true TIME_PREFIX="audittime": " TIME_FORMAT=%Y-%m-%dT%H:%M:%S TRUNCATE=9999 Sample Events { "items": [ { "auditId" : 15067, "secId": "mtt01", "audittime": "2016-07-31T12:24:37Z", "links": [ { "name":"conanicaldba", "href": "https://it.for.dev.com/opa-api" }, { "name":"describedbydba", "href": "https://it.for.dev.com/opa-api/meta-data" } ] }, { "auditId" : 16007, "secId": "mtt01", "audittime": "2016-07-31T12:23:47Z", "links": [ { "name":"conanicaldba", "href": "https://it.for.dev.com/opa-api" }, { "name":"describedbydba", "href": "https://it.for.dev.com/opa-api/meta-data" } ] }, { "auditId" : 15165, "secId": "mtt01", "audittime": "2016-07-31T12:22:51Z", "links": [ { "name":"conanicaldba", "href": "https://it.for.dev.com/opa-api" }, { "name":"describedbydba", "href": "https://it.for.dev.com/opa-api/meta-data" } ] } ] ​ ... View more

Hello, I have issues getting expected field value pairs using following props and transforms configuration files. Sample events and my configuration files are given below. Any recommendation will be highly appreciated.   My Configuration Files [mypropsfile] REPORT-mytranforms=myTransfile [myTransfile] REGEX = ([^"]+?):\s+([^"]+?) FORMAT = $1::$2   Sample Events 2023-11-15T18:56:30.098Z, User ID: 90A, User Type: TempEMP,  Product Code:  pc, UAT:  UTA-True, Event Type:  TEST,  EventID:  Lookup, Remote Host: 25.191.157.244 2023-11-15T18:56:29.098Z, User ID: 90A, Host:  vx2tbax.dev, User Type: TempEMP,  Product Code:  pc, UAT:  UTA-True, Event Type:  TEST,  EventID:  Lookup, Remote Host: 25.191.157.244 2023-11-15T18:56:28.098Z, User ID: 91B, User Type:  TempEMP,  Product Code:  pc, UAT:  UTA-True, Event Type:  TEST,  EventID:  Lookup, Remote Host: 25.191.157.244 2023-11-15T18:56:27.098Z, User ID: 91B, User Type:  TempEMP,  Product Code:  pc, UAT:  UTA-True, Event Type:  TEST,  EventID:  Lookup, Remote Host: 25.191.157.244 2023-11-15T18:56:27.001Z, User ID: 91B, User Type:  TempEMP,  Host:  vx2tbax.dev, Product Code:  pc, UAT:  UTA-True, Event Type:  TEST,  EventID:  Lookup, Remote Host: 25.191.157.244   ... View more

Hello, I have some issues to perform multi-line field extraction for XML, my in-line extraction is not getting any result; sample events and my in-line extraction are provided below. Any help would be appreciated.  Sample Events: <Event> <ID>0123011</ID> <Time>2023-10-28T05:22:37.97011</Time> <Application_Name>Test</Application_Name> <Host_Name>VS0SMADBEFT</Host_Name> </Event> <Event> <ID>01232113</ID> <Time>2023-10-28T05:22:37.99011</Time> <Application_Name>Test</Application_Name> <Host_Name>VS0SMADBEFT</Host_Name> </Event>   In Line Extraction I Used <ID>(?<ID>[^<]+)<\/ID>([\r\n]*)<Time>(?<Time>[^<]+)</Time>([\r\n]*)<Application_Name>(?<Application_Name>[^<]+)</Application_Name>([\r\n]*)<Host_Name>(?<Host_Name>[^<]+)</Host_Name>     ... View more

Hello, I have some issues to perform field extractions using transform configuration. It's not giving field value pairs as expected. Sample events and configuration files are given below. Some non-uniformities within the events are also marked in Bold. Any recommendations will be highly appreciated. Thank you so much. My Configuration Files [mypropfConf] REPORT-mytranforms=myTransConf [myTransConf] REGEX = ([^"]+?):'([^"]+?)' FORMAT = $1::$2 Sample Events 2023-11-15T18:56:29.098Z OTESTN097MA4515620 TESTuser20248: UserID: '90A', UserType: 'TempEMP', System: 'TEST', UAT: 'UTA-True', EventType: 'TEST', EventID: 'Lookup', Subject: 'A5367817222', Scode: '' EventStatus: 0, TimeStamp: '2023-11-03T15:56:29.099Z', Device: 'OTESTN097MA4513020', Msg: 'lookup ok', var: 'Sec' 2023-11-15T18:56:29.021Z OTESTN097MB7513020 TESTuser20249: UserID: '95B', UserType: 'TempEMP', System: 'TEST', UAT: 'UTA-True', EventType: 'TEST', EventID: 'Lookup', Subject: 'A516670222', Scode: '' EventStatus: 0, TimeStamp: '2023-11-03T15:56:29.099Z', Device: 'OTESTN097MA4513020', Msg: 'lookup ok', var: 'tec' 2023-11-15T18:56:29.009Z OTESTN097MB9513020 TESTuser20248: UserID: '95A', UserType: 'TempEMP', System: 'TEST', UAT: 'UTA-True', EventType: 'TEST', EventID: 'Lookup', Subject: 'A546610222', Scode: '' EventStatus: 0, TimeStamp: '2023-11-03T15:56:29.099Z', Device: 'OTESTN097MA4513020', Msg: 'lookup ok', var: 'test'   ... View more

Hello, I was trying to use REGEX command within props/transforms conf files to extraction fields, but field extraction is not working. Two sample events and my props/transforms conf files are given below. Any recommendations will be highly appreciated. Thank you so much. props.conf [mysourcetype] SHOULD_LINEMERGE=false LINE_BREAKER = ([\r\n]+) TIME_PREFIX=^ TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N MAX_TIMESTAMP_LOOKAHEAD=24 TRUNCATE = 9999 REPORT-fieldEtraction = fieldEtraction   transforms.conf [fieldEtraction] REGEX = \{\"UserID\":\"(?P<UserID>\w+)\","UserType":\"(?P<UserType>\w+)\","System":\"(?P<System>\w+)\","UAT":\"(?P<UAT>.*)\","EventType":\"(?P<EventType>.*)\","EventID":"(?P<EventID>.*)\","Subject":"(?P<Subject>.*)\","EventStatus":"(?P<EventStatus>.*)\","TimeStamp":\"(?P<TimeStamp>.*)\","Device":"(?P<Device>.*)\","MsG":"(?P<Message>.*)\"}   Samples Events  2023-10-03T18:56:31.099Z OTESTN097MA4513020 TEST[20248] {"UserID":"8901A","UserType":"EMP","System":"TEST","UAT":"UTA-True","EventType":"TEST","EventID":"Lookup","Subject":"A516617222","EventStatus":"00","TimeStamp":"2023-10-03T18:56:31.099Z","Device":" OTESTN097MA4513020","Msg":"lookup ok"} 2023-10-03T18:56:32.086Z OTESTN097MA4513020 TEST[20248] {"UserID":"8901A","UserType":"EMP","System":"TEST","UAT":"UTA-True","EventType":"TEST","EventID":"Lookup","Subject":"A516617222","EventStatus":"00","TimeStamp":"2023-10-03T18:56:32.086Z","Device":" OTESTN097MA4513020","Msg":"lookup ok"} ... View more